SEKOIA_Loader_Win_Red0044_Powershell_May24

rule SEKOIA_Loader_Win_Red0044_Powershell_May24 : FILE
{
	meta:
		description = "Finds PowerShell scripts used in a malvertising campaign to deliver NetSupport RAT"
		author = "Sekoia.io"
		id = "ba3454b4-31cf-458d-8d78-c5cc5fa348ff"
		date = "2024-05-03"
		modified = "2024-12-19"
		reference = "https://twitter.com/crep1x/status/1786150734121120075"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_red0044_powershell_may24.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "73939f65b93b320b9e220ee284ea524864a6b05c7608213009ac5f00b3faeedc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "Start-Job -ScriptBlock" ascii
		$str02 = "Get-WmiObject" ascii
		$str03 = "-Class Win32_OperatingSystem" ascii
		$str04 = "-Class AntiVirusProduct" ascii
		$str05 = "$_.Exception.Message" ascii
		$str06 = ".DownloadString" ascii
		$str07 = "New-Object Net.WebClient" ascii
		$str08 = "myUserAgentHere" ascii
		$str09 = "GetFolderPath('Desktop'))\\document.pdf" ascii
		$str10 = "Receive-Job -Job" ascii
		$str11 = "Start-Process" ascii

	condition:
		8 of them and filesize < 20KB
}